Scope, Base64URL & CORS Utilities

Base64URL encode/decode, evaluate OAuth scopes against required sets, and inspect CORS preflight headers for token/userinfo endpoints.

Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Scope comparison, Base64URL encode/decode, and CORS preflight probes — all client-side in this tab.

🔒 100% Client-Side Cryptography (Web Crypto API)

Configuration

UTF-8 ↔ Base64URL using @/lib/base64/encode (JWT / OAuth safe alphabet).

Live output

plaintext: hello world
base64url: aGVsbG8gd29ybGQ

Why these auth utilities?

OAuth and OIDC debugging often needs quick Base64URL transforms, checking whether granted scopes cover required ones, and verifying CORS preflight responses from token or userinfo endpoints.

These utilities run in your browser — Base64URL and scope comparison never leave the tab; CORS probes use browser fetch (mode cors) against the URL you provide.

How to use this tool

  1. Use Base64URL to encode UTF-8 text or decode tokens/segments.
  2. Paste granted vs required scopes to see matched, missing, and extra entries.
  3. Enter an endpoint URL and OPTIONS preflight parameters to inspect ACAO / ACAM / ACAH headers.

Frequently asked questions

Does CORS inspection proxy through stbox?

No. The browser issues the OPTIONS request directly. Opaque CORS failures are reported as the browser sees them.

Are tokens stored?

No. Base64URL and scope tools keep values in memory for this tab only.